MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55109a2a108c6539ef4528f9b5fe35ccfae40f86c9595f9b47e923e532d7331f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	55109a2a108c6539ef4528f9b5fe35ccfae40f86c9595f9b47e923e532d7331f
SHA3-384 hash:	51bd1b6552c5ee00cd8675afdedac411a96b8b7309f9c862f192e100602da2aa00e19ac8cb717d2413d490592628112f
SHA1 hash:	bfb6e6acd379099fa80f31fb158a816ca93d5f49
MD5 hash:	992ecaa198bd84f1493c66aad56e5233
humanhash:	double-sixteen-seventeen-october
File name:	992ecaa198bd84f1493c66aad56e5233.exe
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	217'535 bytes
First seen:	2020-07-11 06:12:07 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9228ea5e4c97332d36033d7c45ce4f2b (2 x TrickBot)
ssdeep	6144:HCd4erEjHDcnFn/VmOs/U0j5CwcE+qCP+f+/Xboi:HCdxrEncn9IOtkYEVCP+f+/boi
Threatray	5'104 similar samples on MalwareBazaar
TLSH	952412D2BB0CE4EDE1B5107066BA49861B09AC7B23AAB8EFF7C0F4319E5D65054704ED
Reporter	abuse_ch
Tags:	exe TrickBot

Intelligence

File Origin

# of uploads :

# of downloads :

141

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.Generic.mg.dee42cc0b843e7c2.27137.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Delayed writing of the file

Deleting a recently created file

Launching a process

Launching a service

Connection attempt

Unauthorized injection to a system process

Detection:

trickbot

Link:

https://mwdb.cert.pl/sample/55109a2a108c6539ef4528f9b5fe35ccfae40f86c9595f9b47e923e532d7331f/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-07-11 00:43:38 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=kuijukqqrrstt32ffd43l7rvzt5oid4gzfmv7g2h5er6kmwxgmpq._file

Verdict:

malicious

Label(s):

trickbot

TrickBot

09656a4814259ff9847322cdca7491ea7a2c6a1191ce512b15996509571ab388

TrickBot

0d94462f293a6a366797348ae505498819f598a7e406678d904064a0a4849f98

TrickBot

371975a3cf3e2f2fd23d70c8bafccff1375eb3f2f4bee2b1e1b843ab28d2c30b

TrickBot

583e2b0cb3e97254796a4e4bd6887e4e971dfc8e97c009a6cff84444d01fb237

TrickBot

67e88a34b883c76e3002f09b021177554a51808c1d6a9e9ece620562d14b0d2f

TrickBot

734b259f20b4989df93555fde599b5ea9375a7c10f9e6abadb856bfe54343ec1

TrickBot

843a9782dab6e69053e6f7bef20491fb3b6756919aa0001522d532a4368831fe

TrickBot

912790d045d0e672bfb1069b453c50e22f1ab7b5d728c364ac3c5cdd05e85c4e

TrickBot

9a1fc2de129a140468451b41f79bd76f056f790550a500909f67cf009419a717

TrickBot

+ 5'094 additional samples on MalwareBazaar

Result

Malware family:

trickbot

Score:

10/10

Tags:

trojan banker family:trickbot

Link:

https://tria.ge/reports/200711-xzjw7z8cg2/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Trickbot

Malware Config

C2 Extraction:

95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	mimikatz Create hunting rule
Author:	Benjamin DELPY (gentilkiwi)
Description:	mimikatz

Rule name:	ReflectiveLoader Create hunting rule
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research